Security Announcements
Receiving Security Advisories
The best way to receive any and all security announcements is to subscribe to the Apache Announce Mailing List.
This mailing list has a reasonable level of traffic, and receives notifications only after security reports have been managed by the core Apache teams and fixes are publicly available.
This mailing list also has announcements of releases for Apache projects.
Reporting Vulnerabilities
We strongly encourage people to report such problems to our private security mailing list first, before disclosing them in a public forum.
Please follow the guidelines laid down by the Apache Security team.
Ideally, any issues affecting Apache Pekko and its predecessor project should be reported to the Apache Pekko team first. We will coordinate responsible disclosure with the affected upstream maintainers when needed.